Is Chartnote HIPAA compliant?

Chartnote signs a Business Associate Agreement, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Chartnote with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies.

Does Chartnote sign a BAA?

Yes, it signs a BAA

Chartnote's Terms of Use build its Business Associate Agreement into every account, including free and trial accounts, once a covered entity uses it with patient data. Its trust center says the AI model providers behind its scribe and Copilot process clinical content under a BAA and don't train on it.

Based on 3 sources, all from Chartnote unless marked.

Business associate
Chartnote
Tool
Chartnote
Plans with a BAA
All accounts (free, trial, paid, enterprise)
Checked
Signs a BAA
Chartnote signs a BAA.

By plan

PlanBAAHow to get itConditions
All accounts (free, trial, paid, enterprise)Signs a BAAIncluded in the termsRequest pageChartnote's Terms of Use incorporate its Business Associate Agreement. When a covered entity uses the service with PHI, the BAA applies to every account, including free and trial accounts, from first use. Enterprise customers on a Master Order Form are also governed by its Master Subscription Agreement.[1],[2]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Chartnote says about each one.

AI featureUnder the BAADetails
AI Scribe, Voice Chart, Copilot and CompanionCoveredThese are part of the Chartnote service its BAA covers. Its trust center says the language and speech model providers behind AI Scribe, dictation and Copilot process clinical content under a BAA, don't train on it, and keep it only as long as needed.[3],[1]

Sources

  1. Terms of Use | ChartnoteChartnote, Legal terms. Checked Oct 13, 2026. Archived copy
  2. The AI Scribe That Also Answers Your Clinical QuestionsChartnote, Documentation. Checked Oct 13, 2026. Archived copy
  3. Chartnote Trust CenterChartnote, Trust center. Checked Oct 13, 2026. Archived copy

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.